> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/integrations/integration-fundamentals/siem-integrations/panther.md).
# Panther
## Overview
Material can send issue lifecycle events to Panther via webhook. Panther receives those events through an HTTP source, normalizes fields, and makes the data available for detections, search, and alert routing.
{% hint style="info" %}
**Event Flow**
Material Issue Change event ( `type=CREATE|UPDATE` ) > Material Event Subscription (Webhook) > Panther HTTP Log Source (Bearer auth) > Panther schema normalization > Detections / Search / Alerts.
{% endhint %}
## How to configure the Panther Integration
### Step One: In Your Panther Console
{% hint style="warning" %}
The instructions below are from [Panther's documentation](https://docs.panther.com/data-onboarding/supported-logs/material-security). Always confirm accuracy with Panther.
{% endhint %}
1. In the left-hand navigation bar of your Panther Console, click **Configure**, then **Log Sources**.
2. Click **Create New**.
3. Search for “Material Security,” then click its tile.
4. In the slide-out panel, click **Start Setup**.
5. Follow Panther's [instructions for configuring an HTTP Source](https://docs.panther.com/data-onboarding/data-transports/http#how-to-set-up-an-http-log-source-in-panther), beginning at Step 5.
* In the **Auth method** dropdown field, select **Bearer**.
* Payloads sent to this source are subject to the [payload requirements for all HTTP sources](https://docs.panther.com/data-onboarding/data-transports/http#payload-requirements).
* Do not proceed to the next step until your HTTP endpoint creation has completed.
* You will include this bearer token in Step Two below.
### Step Two: Configure Material Panther Integration
1. In Material, click **Integrations** (in the top tool bar).
2. Scroll to **SIEM**, then click **Panther:**
3. Complete the required fields:
1. **Method**: Set to `POST`
2. **URI**: Your Panther HTTP source
3. **Headers:** Include `{ "Authorization": "Bearer " }` (the bearer token you created in Panther, see [Step One](#step-one-in-your-panther-console) or Panther's docs [here](https://docs.panther.com/data-onboarding/data-transports/http#how-to-set-up-an-http-log-source-in-panther)).
4. **Events**: Two useful events are pre-configured by default: `Issue Change` and `Audit Log Updated`. By default, the webhook triggers any issue change occurs **or** the audit log updates.
1. Optionally, Click the `Issue Change` event row to edit. Consider filtering `Issue Change` further by `statuses` , `severities` , `detections` depending on your needs.
2. Also consider checking the box to enable `Include events for messages being added / removed / interacted with in a phishing case` only for higher volume and more sensitive payloads.
Example Issue Change Filtering
{% hint style="info" %}
Learn more about events [here](/integrations/integration-fundamentals/siem-integrations.md#event).
{% endhint %}
## Payload
Representative structure for the `Issue Change` subscription payload:
{% code overflow="wrap" %}
```json
{
"eventId": "evt_...",
"timestamp": "2026-03-11T15:10:00Z",
"type": "CREATE",
"tenant": { "uDomainId": "..." },
"account": { "uAcctId": "...", "email": "..." },
"issue": { "id": "...", "status": "...", "severity": "...", "detectionId": "..." },
"before": null,
"after": { "status": "open" },
"messageChange": null
}
```
{% endcode %}
***
## Operational Guidance
* **Start least-privilege**: Start with minimal stream filters. Broaden the scope only as required by your Security Operations Center (SOC) needs.
* **Test with sample events**: Validate how the system handles create and update actions before a full production rollout. Learn more about testing [here](/integrations/integration-fundamentals/siem-integrations.md#two-configure-the-siem-integration-in-material).
* **Document ownership**: Designate specific owners:
* Subscription configuration: Responsible for webhook and event settings
* Panther parser and detections: Responsible for managing the Panther parser
* **Track drift**: If you customize event templates, use version control and review them quarterly to ensure they remain aligned with your requirements.
***
## Resources & Troubleshooting
Review [SIEM Integrations](/integrations/integration-fundamentals/siem-integrations.md) for more detail about events and troubleshooting.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.material.security/integrations/integration-fundamentals/siem-integrations/panther.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.